CHAPTER 22

Quantum networks, BB84, and post-quantum cryptography

Learning goals. Separate entanglement distribution from classical communication, derive intercept–resend disturbance, and distinguish QKD from post-quantum cryptography.

22.1 Networks distribute a quantum resource

A quantum network connects systems using quantum channels and classical coordination. It may distribute entanglement for teleportation, remote gates, sensing, or key distribution. It does not permit faster-than-light communication. Classical messages remain necessary for heralding, synchronization, correction information, and authenticated protocol steps.

Optical attenuation limits direct transmission. Ordinary repeaters cannot amplify arbitrary unknown quantum states by cloning. Quantum repeaters instead combine entanglement generation, memories, entanglement swapping, and, depending on the architecture, purification or error correction [64, 65].

Entanglement swapping starts with Bell pairs AB and CD. A Bell-basis measurement on BC projects the distant pair AD into a Bell state determined by the measurement result. Communicating the result identifies the Pauli correction. Entanglement need not have existed directly between A and D beforehand.

A remote gate can be constructed using shared entanglement and local operations with feed-forward. Main and colleagues demonstrated distributed quantum computation across an optical link between modules in 2025 [66]. This is a concrete interconnect experiment, not an already deployed general-purpose quantum internet.

22.2 BB84 prepares incompatible alternatives

Alice chooses a random bit a and a random basis, Z or X. She sends $|0\rangle$ or $|1\rangle$ for Z, and $|+\rangle$ or $|-\rangle$ for X. Bob independently chooses Z or X and measures.

Over an authenticated classical channel they announce bases, keeping only matching-basis positions. They do not publicly announce every retained bit. With uniform independent basis choices, about half the signals survive this sifting step. In an ideal noiseless channel, matching bases give equal bits [67].

They sacrifice a subset to estimate errors, perform information reconciliation, account for information leaked during reconciliation, and apply privacy amplification. Authentication is essential; without it an attacker could conduct separate sessions with both parties.

22.3 Derive the intercept–resend error

Suppose Eve intercepts every signal, independently chooses Z or X, measures, and sends the resulting state to Bob. Condition on Alice and Bob choosing the same basis.

Eve chooses that basis with probability $1/2$, introducing no error. With probability $1/2$, she chooses the conjugate basis. Bob’s result is then random relative to Alice’s, giving error probability $1/2$. Therefore

$$Q=\frac12(0)+\frac12\left(\frac12\right)=\frac14.$$

If Eve attacks a fraction e of signals, the ideal sifted QBER is e/4. Add an independent bit flip with probability q after the measurement. Combining XOR error events gives

$$Q_\mathrm{total}=q+\frac e4-2q\frac e4 =q+(1-2q)\frac e4.$$

The subtraction accounts for two flips canceling. Adding error probabilities without accounting for overlap is only a small-error approximation.

The 25% result concerns this specific attack. It is not a universal threshold guaranteeing security against all adversaries, nor does a low observed QBER prove the absence of side channels [68].

22.4 From raw correlation to a secret key

An idealized asymptotic single-photon BB84 analysis with suitable symmetric assumptions yields a secret fraction per sifted bit of

$$r\ge1-2h_2(Q),\qquad h_2(Q)=-Q\log_2Q-(1-Q)\log_2(1-Q).$$

One term accounts for reconciliation and the other for privacy reduction in the ideal bound. The expression becomes zero near Q≈11%. Real finite-key analyses include parameter-estimation uncertainty, imperfect reconciliation, authentication costs, loss, source assumptions, and a composable security parameter [69].

This formula is not a software recipe for production security. The browser uses it only to illustrate the difference between sifted correlation and asymptotic secret fraction. It does not generate a certified secure key.

Weak coherent laser pulses can contain multiple photons. Decoy-state methods help bound relevant contributions under a source model. Detector imperfections and implementation attacks motivate techniques such as measurement-device-independent QKD. Device-independent protocols use Bell tests under demanding assumptions; a simulated CHSH violation is not a security proof for a physical device.

22.5 QKD and PQC address different layers

Quantum key distribution uses quantum signals plus authenticated classical communication to establish key material with a security proof under physical and protocol assumptions. It requires suitable quantum hardware and channels.

Post-quantum cryptography (PQC) consists of classical algorithms designed to resist known classical and quantum attacks. It can be deployed on ordinary computing and communication systems. It does not require a quantum link. Neither “post-quantum” nor “quantum-safe” means security against every imaginable future mathematical discovery.

NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024 [70]. ML-KEM is a key-encapsulation mechanism, not an encryption mode for arbitrary bulk data. ML-DSA and SLH-DSA are signature schemes. Correct protocol integration, implementations, and key management remain necessary.

Shor threatens the mathematical problems underlying widely used RSA and elliptic-curve systems at sufficient fault-tolerant scale. Grover changes generic search costs and motivates appropriate symmetric-security parameters, but it is not an immediate break of all symmetric encryption. Migration planning must consider long-lived confidential data that may be recorded now and attacked later; this is different from asserting that a cryptographically capable quantum machine already exists.

22.6 Exercises